The Dutch Data Protection Authority (DPA) has issued a fine of €4.75 million penalizing Netflix due to alleged violations of the General Data Protection Act (GDPR). An investigation started in 2019 by the DPA found that Netflix failed to provide individuals with sufficient information in its Privacy Policy and in its responses to data subject access requests. Since GDPR and the DPA’s decision provides important details regarding the information that needs to be provided to individuals, this case is a helpful guidepost for companies to check their Privacy Policies to ensure that the correct information is provided.
Who does GDPR apply to?
Since Netflix is an American company, some may be surprised to learn that the company was fined for violating Europe’s privacy law, GDPR. However, it is important to note that GDPR can and does apply to companies located outside of the European Union. In fact, GDPR will apply if any of the following factors are met, regardless of the company’s location:
- The company has an establishment in the European Union;
- The company offers goods or services in the European Union;
- The company monitors the behavior of residents of the European Union (e.g. through features such as cookies, analytics or pixels).
It is also important to note that GDPR can apply regardless of a company’s size, revenue amount, amount of data collected, or even nonprofit status. In fact, many small businesses and even individuals have been fined for GDPR violations.
What are the GDPR Privacy Policy requirements?
GDPR requires all businesses that need to comply with this law to provide individuals with an accessible and comprehensive Privacy Policy that includes the following disclosures:
- Your name and contact information;
- What personal data you are collecting;
- The purposes for which you will be using that data;
- Whether you will be using personal data for direct marketing purposes;
- Whether you share personal data. If you do share personal data, you will need to list the categories of third parties with whom you share the personal data;
- The legal bases under which personal data is processed;
- The privacy rights provided to individuals;
- How individuals can exercise those privacy rights;
- The fact that individuals can file a complaint regarding the processing of personal data;
- How long you store personal data;
- Information regarding automated decision making (if you engage in automated decision making);
- Information regarding profiling (if you engage in profiling);
- Where you will process personal data, including whether personal data will be transferred outside of the EU;
- The contact details of your Data Protection Office (if you have one); and
- Whether your website uses cookies and other similar tracking technologies.
The DPA found that Netflix’s Privacy Policy failed to comply with GDPR because it did not provide sufficient information regarding the following:
- The purposes and legal bases for processing personal data;
- The categories of third parties with whom personal data will be shared;
- The retention period of personal data (i.e. how long Netflix will store personal data); and
- Safeguards that will be applied in the event that personal data is transferred outside of the European Union.
In addition, the DPA found that Netflix did not provide sufficient information to individuals who requested to access their personal data.
Netflix’s response
In response to the DPA’s investigation, Netflix stated that the DPA is using a more stringent interpretation of the information that business must provide to individuals and that Netflix believed that it had more latitude on how they communicate this information to individuals. Netflix also argued that it tailored its Privacy Policy to be readable on a TV interface, providing additional information in a layered manner.
The DPA has disagreed with Netflix’s response and determined that a fine should be applied since Netflix has failed to provide the required information to individuals using their platform. It is important that business owners review their own Privacy Policies to ensure that all of the requisite information is provided in these policies is correct, comprehensive, and up to date.
